CVE-2022-21907-http.sys

CVE-2022-21907 - http.sys 驱动程序中的双重释放 CVE-2022-21907 - http.sys 驱动程序中的双重释放 概要 未经身份验证的攻击者可以发送带有“Accept-Encoding”HTTP 请求头的 HTTP 请求，在 HTTP 协议栈（http.sys）处理数据包时，于未知编码列表中触发双重释放，最终导致内核崩溃。 易受攻击的系统 Windows Server 2019 和 Windows 10 版本 1809 : ❌ 默认情况下不易受攻击。除非你在...

cve-2022-21907

CVE-2022-21907 Aplicación Golang por 1vere$k CVE-2022-21907 - Double Free en el controlador http.sys. Resumen Esta es una aplicación Golang de subprocesos múltiples que permite hacer solicitudes a algunos objetivos simultáneamente. No es muy productiva con las solicitudes POST, pero proporciona...

CVE-2021-31166

CVE-2021-31166 检测利用CVE-2021-31166（HTTP协议栈漏洞）的尝试 Suricata规则 Zeek包 参考来源 https://corelight.blog/2021/05/27/detecting-cve-2021-31166-http-vulnerability/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-31166 https://github.com/0vercl0k/CVE-2021-31166...

CVE-2021-31166

CVE-2021-31166 为什么 我最近为 CVE-2021-31166 编写了一个漏洞利用程序，它利用了 CVE-2021-31166 和 CVE-2021-31166。渗透测试人员应该使用 https://github.com/mauricelambert/CVE-2021-31166，但在 SOC 团队中，我们需要了解具体的漏洞以便正确修复，这就是我编写此漏洞利用程序的原因。 描述 我提供了纯 Python、PowerShell、Ruby 脚本以及 Metasploit、nmap 模块，用于攻击易受攻击的 IIS Web 服务器（执行 DOS 攻击以使服务器崩溃（蓝屏））。...

CVE-2021-31166-Exploit

CVE-2021-31166-Exploit 针对MS HTTP协议栈RCE漏洞（CVE-2021-31166）的利用程序 精心构造的HTTP请求指向存在漏洞的Windows版本将导致DOS攻击。服务器将以蓝屏错误重启。 Http.sys是Windows内核驱动程序，负责处理HTTP请求并构造响应。 此存在漏洞的http.sys驱动程序无法处理特制的"Accept-Encoding"头部，导致崩溃，进而服务器重启。 在蓝屏上，我们可以看到错误信息"停止代码: KERNEL SECURITY CHECK FAILED" 这是一个严重漏洞，CVSS评分为9.8，易于利用。...

EUVD-2026-18378

Rack has quadratic complexity in Rack::Utils.selectbestencoding via wildcard Accept-Encoding header...

UBUNTU-CVE-2026-34230

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a respon...

CVE-2026-34230 Rack: Quadratic complexity in Rack::Utils.select_best_encoding via wildcard Accept-Encoding header

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.selectbestencoding processes Accept-Encoding values with quadratic time complexity when the header contains many wildcard entries. Because this method is used by Rack::Deflater to choose a respon...

Integer Overflow lead to DOS in handling Accept-Encoding header in API /v2/models/<model-name>/generate

This report is not public...

EUVD-2018-0581

Malware in sbrugna...

EUVD-2003-0833

Malware in sbrugna...

Incorrect Input Validation

Apache Traffic Server is vulnerable to Incorrect Input Validation. The vulnerability is caused due to Invalid Accept-Encoding header. This can lead to fail cache lookup and force forwarding requests...

The vulnerability of the Apache Traffic Server web server, related to insufficient input validation, allows attackers to execute arbitrary requests.

The vulnerability of the Apache Traffic Server web server is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary requests using the HTTP Accept-Encoding header...

DEBIAN-CVE-2024-35296

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue...

UBUNTU-CVE-2024-35296

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue...

PT-2024-5532 · Apache · Apache Traffic Server

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 8.1.10 Apache Traffic Server versions 9.0.0 through 9.2.4 Description: The issue is related to insufficient input validation, allowing a remote attacker to execute arbitrary requests using the HTTP...

GHSA-CQJG-WHMM-8GV6 Denial of Service via malformed accept-encoding header in hapi

Affected versions of hapi will crash or lock the event loop when a malformed accept-encoding header is recieved. Recommendation Update to version 16.1.1 or later...

Denial Of Service (DoS)

hapi is vulnerable to denial of service DoS attacks. A malicious user can send a malicious accept-encoding header to the system that causes the library to crash or the client to hang until the timeout period is reached...